CVE-2024-50420CWE-434

WordPress aDirectory plugin <= 1.3 - Arbitrary File Upload vulnerability

Critical · published October 29, 2024

CVSS v3.1
10.0
EPSS
1%
Percentile
42.7
In the wild
Unconfirmed
What it is

🚨 If you thought uploading files was just a harmless act, think again! aDirectory's unrestricted upload vulnerability can let attackers unleash a web shell on your server! 🔥 It's like giving someone a spare key to your house and telling them they can decorate the living room however they like — except they’ve got plans to host a wild party instead! With this vulnerability, attackers could execute arbitrary code on your server, effectively taking full control. Imagine them snooping through your files, stealing sensitive data, or even shutting down your operations entirely. This isn’t just a minor inconvenience; it could lead to devastating data breaches!

Put simply

It's like giving someone a spare key to your house and telling them they can decorate the living room however they like — except they’ve got plans to host a wild party instead! The unrestricted upload of file with dangerous type vulnerability in aDirectory allows malicious files, like web shells, to be uploaded without proper checks, potentially allowing an attacker to execute harmful commands on the server.

What to do

With this vulnerability, attackers could execute arbitrary code on your server, effectively taking full control. Imagine them snooping through your files, stealing sensitive data, or even shutting down your operations entirely. This isn’t just a minor inconvenience; it could lead to devastating data breaches! Update aDirectory to version 1.3.1 or later immediately to close this vulnerability. Additionally, implement strict file type validation and limit upload permissions to only trusted users to further secure your server. You've got this! Follow these steps, and you’ll be taking control of your security in no time. 🛡️

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00511 · 42.7th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2024-10-29T08:32Z
EPSS history
Timeline
  • 29 OCT 08:32Z
    WordPress aDirectory plugin <= 1.3 - Arbitrary File Upload vulnerability
    cvelistv5